CN114967602A

CN114967602A - Information collection device, computer-readable recording medium, and information collection method

Info

Publication number: CN114967602A
Application number: CN202210146380.4A
Authority: CN
Inventors: 森田隆介; 小林龙治; 木下航; 秋山悟
Original assignee: Yokogawa Electric Corp
Current assignee: Yokogawa Electric Corp
Priority date: 2021-02-22
Filing date: 2022-02-17
Publication date: 2022-08-30
Also published as: US20220270469A1; US11893873B2; JP7280301B2; JP2022128148A

Abstract

The present invention provides an information collecting device, a computer readable recording medium and an information collecting method, which can effectively collect information for investigation indicating the reason of an abnormal alarm related to a control station for a factory, the information collecting device comprises: a receiving unit that receives an alarm indicating an abnormality in a control station for a plant; and a collecting unit that collects information for investigation of the cause of the alarm from a location of the control station specified based on the alarm received by the receiving unit.

Description

Information collection device, computer-readable recording medium, and information collection method

Technical Field

Embodiments of the present invention relate to an information collection apparatus, a computer-readable recording medium, and an information collection method.

Background

For example, patent document 1 discloses a device for managing an alarm indicating an abnormality in a plant control station.

Documents of the prior art

Patent document 1: japanese patent No. 6604455

Conventionally, if an alarm is received, an engineer goes to the site to collect information for investigation of the cause of the alarm. In this case, for example, since the movement of the engineer takes time, there are problems as follows: appropriate information cannot be collected in time, or such movement is difficult due to environmental conditions or the like. Therefore, there is a demand for an efficient information collection technique.

Disclosure of Invention

The purpose of the present invention is to efficiently collect information for investigation of the cause of an alarm indicating an abnormality in a control station for a plant.

An information collection apparatus of one aspect includes: a receiving unit that receives an alarm indicating an abnormality in a control station for a plant; and a collecting unit that collects information for investigation of the cause of the alarm from a location of the control station specified based on the alarm received by the receiving unit.

A computer-readable recording medium of one aspect records an information collection program, and a computer executes the following processing by executing the information collection program: an alarm indicating an abnormality in a control station for a plant is received, and information for investigation of the cause of the alarm is collected from a site of the control station specified based on the received alarm.

An information collection method of one aspect includes: an information collection device receives an alarm indicating an abnormality related to a control station for a plant; and an information collection device that collects information for investigation of the cause of the alarm from a location of the control station specified based on the received alarm.

According to the present invention, it is possible to effectively collect investigation information indicating the cause of an abnormal alarm relating to a control station for a plant.

Drawings

Fig. 1 is a diagram showing an example of a schematic configuration of an information collection device according to an embodiment.

Fig. 2 is a diagram showing an example of a schematic configuration of the operation monitoring terminal.

Fig. 3 is a diagram showing an example of arbitration.

Fig. 4 is a diagram showing an example of a monitoring target alarm table.

Fig. 5 is a diagram showing an example of the alarm management table.

Fig. 6 is a diagram showing an example of an abnormality correspondence step table.

Fig. 7 is a diagram showing an example of information collection based on countdown of the counted time.

Fig. 8 is a diagram showing an example of information collection based on countdown of the counted time.

Fig. 9 is a diagram showing an example of information collection based on countdown of the timer time.

Fig. 10 is a diagram showing an example of information collection based on countdown of the timer time.

Fig. 11 is a diagram showing an example of information collection based on countdown of the timer time.

Fig. 12 is a flowchart showing an example of processing executed in the operation monitoring terminal.

Fig. 13 is a flowchart showing an example of processing executed in the operation monitoring terminal.

Fig. 14 is a flowchart showing an example of processing executed in the operation monitoring terminal.

Fig. 15 is a diagram showing an example of a schematic configuration of an operation monitoring terminal according to a modification.

Fig. 16 is a diagram showing an example of a schematic configuration of a learning completion model.

Fig. 17 is a diagram showing an example of a hardware configuration of the operation monitoring terminal.

Description of the reference numerals

1 factory, 2 field device, 3 control station, 4 engineering terminal, 5 operation monitoring terminal, 51 receiving part, 52 storing part, 53 selecting part, 54 registering part, 55 collecting part, 56 learning part, 52a program, 53a monitoring object alarm table, 54a alarm management table, 55a abnormality corresponding step table, 55b learning completion model, 56a training data.

Detailed Description

The following describes embodiments with reference to the drawings. The same elements are denoted by the same reference numerals, and overlapping descriptions are appropriately omitted.

Fig. 1 is a diagram showing an example of a schematic configuration of an information collection device according to an embodiment. The information collection device according to the embodiment is referred to as an operation monitoring terminal 5. The operation monitoring terminal 5 is used for monitoring the plant 1 and the like.

The plant 1 is a plant or the like including various facilities for obtaining products. Examples of the product are LNG (liquefied natural gas), resin (plastic, nylon, etc.), chemical products, and the like. Examples of facilities are plant facilities, mechanical facilities, production facilities, power generation facilities, storage facilities, facilities in wellheads for producing oil, natural gas, and the like.

At various locations of the plant 1, field devices 2 are provided. The field device 2 is configured to be able to communicate with other devices such as the control station 3 by wireless communication, wired communication, or the like. The field device 2 is roughly classified (classified) into a sensor device and an operation device, for example. The sensor device is, for example, a device that acquires (detects, measures, or the like) a physical quantity. Examples of sensor devices are pressure sensors, temperature sensors, flow sensors, pH sensors, speed sensors, acceleration sensors, etc. The operating device is, for example, a device that operates on physical quantities. Examples of operating devices are valves, pumps, fans, etc. driven by electric motors, actuators, etc.

The control station 3 is a plant control station for controlling the plant 1. An example of the control is operation control of the plant 1. Such a control station 3 is also called an operation control device or the like. For example, the control station 3 controls the operation of the plant 1 so that the plant 1 operates in a desired state.

An example of the operation control will be described. For example, the control station 3 controls the operating value MV such that the process value PV approaches the set value SV. The process value PV is data representing the state of the process in the plant 1. The process value PV is obtained, for example, by the corresponding field device 2. Examples of process values PV are pressure, temperature, flow, pH, velocity, acceleration, etc. The set value SV is data (target value) indicating a target of the process value PV in the plant 1. The set value SV is supplied to the control station 3, for example, for control of the plant 1. Examples of setpoint values SV are pressure, temperature, flow, pH, speed, acceleration, etc., as well as process values PV. The operation value MV is data indicating an operation in the plant 1. The operating value MV is taken from the corresponding field device 2 or is supplied to the corresponding field device 2 from the control station 3, for example. The field device 2 acts in accordance with the supplied operating value MV. Examples of the operation value MV are a valve operation amount (e.g., a valve opening degree), a pump operation amount, a fan operation amount, and the like.

As illustrated in fig. 1, a plurality of control stations 3 may be provided in the plant 1. Each control station 3 is responsible for controlling the operation of a corresponding part of the plant 1. For example, each control station 3 acquires data from the corresponding field device 2 or transmits data to the corresponding field device 2. The number of control stations 3 and the number of field devices 2 corresponding to each control station 3 can be determined arbitrarily. Each control station 3 and each field device 2 can be 1: 1 corresponds to. Each control station 3 may be disposed in the plant 1.

The engineering terminal 4 and the operation monitoring terminal 5 are communicably connected to the control station 3. In this example, the control station 3, the engineering terminal 4, and the operation monitoring terminal 5 are connected via a control bus. The control bus is a dedicated bus (also referred to as a network or the like) configured for data transfer.

Some of the data transmitted via the control bus is used for the control of the plant 1. Real-time control may also be included in the control. It is extremely important to prevent failures such as a lack of data transfer in the control bus. The control bus is constructed, for example, as a dedicated special network, and is duplicated from the viewpoint of improving reliability and the like (see also fig. 3 described later). The duplicated control bus can transmit and receive the same data in parallel through two communication paths. Even if a failure or the like occurs in one communication path, data transmission (transmission/reception) can be maintained. Examples of a network constituting such a control bus are Vnet/IP (registered trademark) and the like.

A plurality of control stations 3 may be configured by each domain division of the control bus. For example, more than one control station 3 is separately housed in each room corresponding to each domain of the control bus. Some of the domains of the control bus are illustrated as domain D1 and domain D2. In this example, the domain D1 and the domain D2 correspond to two or more control stations 3, respectively.

The engineering terminal 4 is used for, for example, the setup, maintenance, operation, etc. of the control station 3. For example, the engineering terminal 4 is used for setting the control station 3, updating software (an example of offline operation described later), and the like.

The operation monitoring terminal 5 monitors the plant 1 based on data from the control station 3, and also based on user operations and the like. For example, the operation monitoring terminal 5 receives an alarm indicating an abnormality related to the control station 3 and presents the alarm to a user (operator or the like) operating the operation monitoring terminal 5. Hereinafter, an alarm indicating an abnormality related to the control station 3 may be simply referred to as "alarm".

In the present embodiment, the operation monitoring terminal 5 functions as an information collection device that collects (acquires, etc.) information that can be used for investigation (identification, analysis, etc. of a cause of an alarm). Hereinafter, such information may be simply referred to as "survey information" or "alarm survey information".

Fig. 2 is a diagram showing an example of a schematic configuration of the operation monitoring terminal. The operation monitoring terminal 5 includes: a receiving section 51, a storage section 52, a selection section 53, a registration section 54, and a collection section 55. In short, the receiving section 51 receives an alarm from the control station 3. The storage section 52 stores information necessary for operating the process in the monitoring terminal 5. The selection unit 53 selects the alarm received by the reception unit 51. The registration unit 54 registers the alarm selected by the selection unit 53. The collecting unit 55 collects information for investigation of the alarm registered by the registering unit 54. The data transmission via the control bus is used to receive alarms and collect survey information. Hereinafter, each part will be described in detail.

The receiving section 51 receives an alarm. The alert includes, for example, an alert id (no) and information content describing the content of the alert. In one embodiment, the alert is identified by a combination of location information and position information. The part information indicates the type of the part of the control station 3. The position information indicates the position of the part of the control station 3. Hereinafter, the combination of the location information and the position information is referred to as "arbitration".

Fig. 3 is a diagram showing an example of arbitration. An example of the appearance of the control station 3 is shown on the left side of fig. 3, and "CPU card", "the whole I/O suite", "I/O module", and "control bus" in the part information indicating the type of each part are exemplified.

The part information "CPU card" is information indicating a CPU card in the control station 3. Hereinafter, the CPU card may be simply referred to as "CPU". The CPU is responsible for arithmetic processing and the like required for controlling the plant 1. From the viewpoint of importance of preventing a failure such as a lack of control of the plant 1, the control station 3 includes a plurality of CPUs for making the CPUs redundant (for example, double). One of the duplexed CPUs operates, and the other CPU stands by. If an abnormality occurs in the operating CPU, an alarm indicating the abnormality is generated, and the standby CPU is switched to the operating CPU.

The part information "I/O suite as a whole" is information indicating the whole I/O suite in the control station 3. The I/O suite is composed of a plurality of I/O modules.

The site information "I/O module" is information indicating an I/O module (I/O device unit) within the control station 3. The I/O module is responsible for input and output of various data for control of the control station 3, and the like. Examples of the input data are data from the field device 2, data from the control bus (from the operation monitoring terminal 5 and the like), and the like. Examples of the output data are data to the field device 2, data to the control bus (to the operation monitoring terminal 5, etc.), and the like.

The component information "control bus" is information indicating a control bus to which the control station 3 is connected. The component information "control bus" may be information indicating a control bus (the entire control bus) or may be information indicating only a portion of the control bus to which the control station 3 is connected. Fig. 3 schematically shows two communication paths of a duplicated control bus.

In the position information indicating the position of the part of the control station 3, "domain", "station", "CPU control", "I/O system", "I/O node", "I/O unit", and "I/O slot" are illustrated on the right side of fig. 3.

The location information "field" is information indicating a location of a field of the control bus (field D1, field D2, etc. of fig. 1). In this example, the position information "field" is represented by a number (field No).

The location information "station" is information indicating the location of the control station 3 within the domain. In this example, the position information "station" is represented by a number (station No).

The position information "CPU control" is information indicating the positions of the running CPU and the standby CPU among the redundant CPUs in the control station 3. In this example, the position information "CPU control" is represented by either a CPU in operation (control execution) or a CPU in standby (control/standby of a redundant CPU).

The location information "I/O system" is information indicating the location of the I/O system within the control station 3. In this example, the location information "I/O system" is represented by a number (I/O interface system No).

The location information "I/O node" is information indicating the location of an I/O suite within the control station 3. In this example, the location information "I/O node" is represented by a number (I/O suite No).

The location information "I/O unit" is information indicating the location of an I/O device unit within the control station 3. In this example, the location information "I/O cell" is represented by a number (I/O device cell No).

The location information "I/O slot" is information indicating a slot of an I/O device unit within the control station 3. In this example, the position information "I/O slot" is represented by a number (slot No of the I/O device unit).

For example, the above-described location information and position information are appropriately combined in a range not inconsistent with each other to constitute arbitration. Examples of arbitration are a combination of the part information "CPU" and the position information "CPU control", a combination of the part information "I/O suite as a whole" and the position information "field", "station", and a combination of the part information "I/O module" and the position information "field", "station", "I/O system", "I/O node", "I/O unit", "I/O slot", and the like.

In addition to the location information and the position information illustrated in fig. 3, various information indicating the type of the location of the control station 3 may be regarded as the location information, and various information indicating the position of the location of the control station 3 may be regarded as the position information.

An example of the use of arbitration is explained. As described above, arbitration may be used for identification of alarms. For example, the correspondence between an alarm (alarm ID, information content, etc.) and arbitration is determined in advance, and based on the correspondence, the alarm is identified by arbitration. Furthermore, arbitration may be used for determination of the location of the control station 3. For example, the CPU of the control station 3 is determined to be one of the operating CPU and the standby CPU by a combination of the part information "CPU" and the position information "CPU control".

Returning to fig. 2, the storage unit 52 stores various information necessary for processing executed in the operation monitoring terminal 5. The program 52a, the monitored alarm table 53a, the alarm management table 54a, and the abnormality correspondence step table 55a are illustrated as examples of information stored in the storage unit 52. The program 52a is a program (information collection program) for causing a computer to execute processing for operating the monitoring terminal 5 (information collection device). The monitored object alarm table 53a, alarm management table 54a, and abnormality correspondence step table 55a will be described later.

The selection unit 53 selects an alarm to be monitored from the alarms received by the reception unit 51. The alarm received by the receiving unit 51 includes an alarm with a low necessity of collecting information for investigation. For example, in the plant 1, even when the opening and closing operation of the valve is performed within the allowable range of the operation control, information indicating the opening and closing operation can be generated as an alarm. There is little necessity for collecting information for investigation of such an alarm. The selection section 53 performs a preliminary selection (filtering) to eliminate such an alarm. For example, by referring to the monitored object alarm table 53 a.

Fig. 4 is a diagram showing an example of a monitoring target alarm table. In this example, the monitoring target alarm table 53a is described by associating "alarm", "necessity of monitoring", and "time counting".

The "alarm" is an alarm received by the receiving unit 51, and is schematically represented as "alarm a" or the like in the drawing. "whether monitoring is required" indicates whether the alarm should be a target of monitoring, and more specifically indicates whether the alarm should be a target of information collection described later. Whether or not an alarm that needs to be monitored as "to" is a monitoring target. An alarm whether or not monitoring is required to be "no" is not a monitoring target. In this example, alarm a and alarm B are monitoring objects. The alarm C is excluded from the monitored object.

The "timed time" is used to exclude a portion of the alarm. The principle is explained later. In fig. 4, "delay time" and "dead time" are illustrated as the timer time. In this example, the timer time of alarm a is a delay time, which is 20 seconds in length. The timer time of alarm B is a dead time, which is 30 seconds in length. As will be described later, the correspondence between the counted time and the alarm and the specific length of the counted time are appropriately set.

Alarm exclusion based on the time of counting will be explained. Sometimes a set of alarms are generated consecutively that are the same or have a correlation with each other. If all of these pieces of alarm survey information are collected, the amount of information increases, and the proportion of useless information (duplicated information and the like) also increases. If useless information increases, it is difficult to determine the cause of an alarm, and the like. Further, if the amount of information increases, the amount of data transferred through the control bus increases accordingly, and the load on the control bus becomes large. As described above, since high reliability is required for the control bus, it is necessary to suppress the load on the control bus as much as possible. In this sense, at least a part of the set of alarms is preferably excluded. Some examples of a set of alarms are illustrated.

An example of a set of alarms is alarms generated due to a failure of the CPU. For example, if a failure (fail) occurs in the running CPU, an alarm is generated, and the standby CPU is switched to the running CPU. Self-diagnosis is made in the failed CPU. In the self-diagnosis, it is confirmed whether or not the CPU can recover (recovery) from a failure, and the like. If the CPU can be recovered, the CPU becomes a standby CPU, and the duplication of the CPU is maintained. By this self-diagnosis, it is possible to generate an oscillation in which the CPU repeatedly malfunctions and recovers. The same alarm is generated each time the failure and recovery are repeated. The alarms repeatedly generated in the above manner are the same set of alarms generated due to the failure of the CPU. The same alarm may be identified with the same arbitration correspondence. In this example, the same arbitration is a combination of the location information "CPU" and the position information "CPU control".

For a group of alarms generated due to the oscillation, it is effective to collect information for investigation of only one of the alarms and to exclude the remaining alarms. It is preferable that the information for investigation is collected after the oscillation converges and the CPU operation is stabilized. For example, after a certain period of time has elapsed since the reception unit 51 received the alarm, it is sufficient to start collecting the information for investigation of the alarm. The fixed period may be determined based on a period until the oscillation converges. The delay time is used to exclude such alarms. The delay time is set to a timer time for delaying collection of the investigation information of the corresponding alarm.

Another example of a set of alarms is alarms generated as a result of offline operations (offline engineering operations). The offline operation is, for example, an operation associated with the reset of the control station 3, and the operation control of the plant 1 by the control station 3, for example, communication with the field devices 2, and the like are stopped. Examples of the offline-operation are software update of the control station 3 and the like. Due to the offline operation, various alarms indicating abnormality of each part of the control station 3 are generated, for example. For example, with respect to an I/O module, an alert is generated indicating the start of the download of the information content of the database to the I/O module. This influence generates an alarm indicating an abnormality or the like of the I/O module. The CPU generates an alarm indicating stop of the control station or the like. Due to this influence, an alarm indicating a failure (fail) of the control station 3 or the like is generated. These alarms are a set of alarms that are associated with each other due to offline operations.

It is effective that the survey information is not collected (excluded) from a group of alarms having a correlation with each other generated by the offline operation. This is because the reason for the alarm is known to be offline operation. As will be described later, the elimination of such alarms is accomplished by dead time. The dead time is a timing time for ignoring alarms having a correlation with each other. Details of the dead time will be described later.

Another example of a set of alarms is an alarm generated due to an abnormality in a specific part of the control station 3. More specifically, when there are some parts (affected parts) where an abnormality occurs due to the influence of an abnormality of a specific part, the alarms generated for these affected parts are a set of alarms having a correlation with each other. For example, as a recovery alarm against a failure of the control station (due to an abnormality of the CPU), alarms such as a reset start, an automatic reset start, an energization initialization start, and an energization continuation start of the control station are generated. Due to this influence, an alarm indicating an abnormality of the bus connecting the I/O unit and the CPU, an abnormality of the I/O module, or the like is generated. These alarms are a set of alarms that are associated with each other due to offline operations. These alarms are a group of alarms having correlation with each other with respect to affected parts (e.g., I/O unit, I/O module, etc.) which are generated by being affected by an abnormality of a specific part (e.g., CPU).

It is also effective that the information for investigation is not collected from a group of alarms having a correlation with each other due to an abnormality in the affected part. This is because it is sufficient to collect information for investigation of an alarm at a specific portion. As will be described later, the elimination of such alarms is also accomplished by dead time.

The monitored target alarm table 53a associates the delay time with the same set of alarms (for example, alarms generated due to a failure of the CPU). Specific contents such as how long the delay time is associated with which alarm can be set as appropriate in accordance with the operation of the actual alarm generation or the like. For example, a delay time is set, which indicates the length of a period (time required for oscillation to converge, etc.) including the generation of a set of alarms generated due to a failure of the CPU.

The monitored target alarm table 53a associates the dead time with a set of alarms having a correlation with each other as described above (for example, alarms generated due to offline work, abnormality in a specific portion, or the like). Specific contents such as what degree of the dead time is associated with which alarm can be appropriately set according to the operation of the actual alarm generation or the like. For example, a dead time is set, which includes the length of a period in which the occurrence of each of a set of alarms caused by offline work is included, the length of a period in which the occurrence of each of a set of alarms indicating an abnormality affecting a portion caused by an abnormality of a specific portion is included, and the like.

Returning to fig. 2, the registration unit 54 registers the alarm selected by the selection unit 53. More specifically, the registration section 54 registers the alarm, arbitration, and timer time in the alarm management table 54a in association with each other.

Fig. 5 is a diagram showing an example of the alarm management table. In this example, the alarm management table 54a describes "alarm", "arbitration", "suppression", and "timer" in correspondence. The alerting and arbitrating are as described above.

"inhibit" indicates which of the delay time and the dead time the timer time is. Suppression "ON" indicates that the timing time is a dead time. Inhibit "OFF" means that the count time is a delay time.

The "chronograph time" indicates the remaining time of the chronograph time in the countdown. In this example, the remaining time of the timer time (delay time) of the alarm a is 20 seconds, and the remaining time of the timer time (dead time) of the alarm B is 30 seconds.

Returning to fig. 2, the registration unit 54 registers the alarm in the alarm management table 54a with the same alarm override as the alarm registered in the alarm management table 54a and whose delay time is counted down. By the override registration, the registered alarm is deleted (excluded) from the alarm management table 54 a. The delay time in the countdown is reset (e.g., back to 20 seconds again). In this case, the same alarm can be identified corresponding to the same arbitration. In this case, the registration unit 54 registers the alarm management table 54a with the same arbitration as the arbitration of the alarm registered in the alarm management table 54a and whose delay time is counted down.

The registration unit 54 does not register (exclude) an alarm in the alarm management table 54a, the alarm having a correlation with the alarm registered in the alarm management table 54a and having a countdown dead time. In this case, correlated alarms can be identified in correspondence with the correlated arbitration. In this case, the registration section 54 does not register an arbitrated alarm in the alarm management table 54a in association with arbitration of an alarm which is registered in the alarm management table 54a and whose dead time is in countdown.

The collecting unit 55 reads the alarm received by the receiving unit 51, more specifically, the alarm selected by the selecting unit 53 and registered in the alarm management table 54a by the registering unit 54, as necessary, and collects the survey information of the read alarm.

As described above, the counted time is counted down for the alarms registered in the alarm management table 54 a. The collecting unit 55 does not collect the survey information registered in the alarm management table 54a and the counted time is the alarm during countdown. It is also considered that a period for collecting survey information for reserving an alarm is provided by counting time.

The collecting unit 55 collects information for investigation of an alarm when counting down of the counted time is completed, as necessary. Specifically, the collecting unit 55 collects information for investigation of an alarm indicating the end of the countdown of the delay time. That is, the collecting unit 55 starts collecting the information for investigation of the alarm received by the receiving unit 51 after a certain period of time has elapsed from the time of receiving the alarm. On the other hand, the collecting unit 55 does not collect the information for investigation of the alarm at the end of the countdown of the dead time.

The collecting unit 55 collects the survey information from the corresponding control station 3. The location of the corresponding control station 3 is determined based on the alarm (e.g., alarm ID and/or information content), specifically, for example, in the collection step corresponding to the alarm in the abnormality correspondence step table 55 a. The collection unit 55 collects the survey information by referring to the abnormality correspondence step table 55 a.

Fig. 6 is a diagram showing an example of an abnormality correspondence step table. In this example, the abnormality correspondence step table 55a describes correspondence between "alarm" and "collection step".

The "collection step" is information describing a collection step of information for investigation, and is schematically represented as "collection step a" or the like in the drawing. In this example, the step of collecting information for investigation of alarm a is the collecting step a, and the step of collecting information for investigation of alarm B is the collecting step B. The collection step includes, for example, starting of an execution file for acquiring desired survey information from a part of the control station 3 to be a target of information collection. The collecting step may include sequentially launching a plurality of different execution files, etc. (multiple steps). For example, the corresponding execution files are started in the order from a large part (for example, a control bus) to a small part among the parts of the control station 3, and the information for investigation is collected.

For example, as described above, the survey information is collected for some of the alarms that have ended the countdown of the counted time. Some examples of operations related thereto are described with reference to fig. 7 to 11.

Fig. 7 to 11 are diagrams showing examples of information collection based on countdown of the timer time. In the example shown in fig. 7, the same alarm (same arbitrated alarm) is generated only once with respect to the delay time. At time t11, a first alarm (alarm first time) is received and registered with the delay time. A countdown of the delay time is started. At time t21, the countdown of the delay time ends and information collection starts.

In the example shown in fig. 8, the same alarm is generated twice with respect to the delay time. At time t11, a first alarm (alarm first) is received and registered with the delay time. A countdown of the delay time is started. At time t12 before the countdown of the delay time is completed, the second alarm (alarm second time) is received, and the delay time is reset. The first alarm is excluded (cancelled) and the second alarm is registered together with the delay time. At time t22, the countdown of the delay time is completed, and the collection of the information for investigation of the second alarm is started.

In the example shown in fig. 9, the same alarm is generated N times with respect to the delay time. N is an integer of 2 or more. At time t11, a first alarm (alarm first) is received and registered with the delay time. A countdown of the delay time is started. At time t12 before the countdown of the delay time is completed, the second alarm (alarm second time) is received, and the delay time is reset. Excluding the first alarm, the second alarm is registered together with the delay time. At time t1N before the countdown of the delay time is completed, the nth alarm (alarm nth time) is received, and the delay time is reset. Excluding the second alarm, the nth alarm is registered together with the delay time. At time t2N, the countdown of the delay time is completed, and the collection of information for investigation of the nth alarm is started.

In the example shown in fig. 10, some alarms due to offline work are generated with respect to the dead time, but information for investigation of these alarms is not collected (alarms are excluded). At time t31, an alarm (offline-job information) generated by the offline-job is received and registered. The countdown of the dead time is started. At time t32 before the end of the countdown of the dead time, an alarm generated due to (associated with) the previous offline operation is received, but is ignored (excluded). That is, the alarm is not registered in the alarm management table 54 a. At time t41, the countdown of dead time ends, also excluding the alarm generated at the previous time t 31. The following description will be made with respect to an alarm generated thereafter (an alarm after the dead time) in the same manner as above. In this example, at time t51, an alert is received and registered. At time t61, the countdown of the delay time is started. The countdown of the delay time is completed, and the collection of the information for investigation of the alarm is started.

In the example shown in fig. 11, regarding the dead time, alarms of some affected parts generated due to alarms of specific parts of the control station 3 are generated, but information for investigation of alarms of these affected parts is not collected (alarms are excluded). At time t71, an alarm for a specific part is received and registered together with the delay time. A countdown of the delay time is started. At time t72, an alarm of the affected part is received and registered together with the dead time. At time t73 before the dead time ends, the alarm of the affected part is received, but is ignored (excluded). At time t74, the measurement of the delay time is completed, and the collection of information for investigation of an alarm at a specific portion is started. At time t75, the countdown of dead time ends, also excluding the alarm generated at the previous time t 72. The following description will be made with respect to an alarm generated thereafter (an alarm after the dead time) in the same manner as above. In this example, at time t81, an alarm about another location is received and registered. At time t91, the countdown of the delay time is started. The countdown of the delay time is completed, and the collection of the information for investigation of the alarm is started.

For example, as described above, at least a portion of a set of alarms that are the same or have a correlation with each other are excluded by utilizing a delay time or a dead time. The collecting unit 55 effectively collects useful information for investigation.

Returning to fig. 2, the collection unit 55 may include a GUI (Graphical User Interface) for presenting (displaying, etc.) the collected information for investigation to the User. For example, the collected information for investigation can be reduced and presented in accordance with the user operation. Examples of the reduction are reduction by the kind of each alarm, reduction by each arbitration, and the like. Further, the information of the alarm which is not to be the collection target of the survey information of the collection unit 55 and excluded from the alarms received by the GUI presentation receiving unit 51, more specifically, the alarms selected by the selection unit 53 and registered by the registration unit 54 may be used. The information presented in the above manner can be used for, for example, a study to exclude the adequacy of an alarm or the like.

Fig. 12 to 14 are flowcharts showing an example of a process (operation monitoring method (information collection method)) executed by the operation monitoring terminal.

Fig. 12 shows an example of some processes from the reception of an alarm to the collection of information for investigation. The detailed processing is as described above, and therefore, the description will not be repeated.

In step S1, the operation monitoring terminal receives an alarm. As described above, the receiving unit 51 of the operation monitoring terminal 5 receives the alarm.

In step S2, the operation monitoring terminal selects an alarm of the monitoring target. As described above, the selection unit 53 of the operation monitoring terminal 5 refers to the monitoring target alarm table 53a and selects the alarm of the monitoring target from the alarms received by the reception unit 51 in the previous step S1. Correspondence of the timer time and the like is also performed.

In step S3, the operation monitoring terminal registers an alarm. As described above, the registration unit 54 of the operation monitoring terminal 5 registers the alarm selected by the selection unit 53 in the alarm management table 54a in the previous step S2. Arbitration and timing times, etc. are also registered.

In step S4, the operation monitoring terminal collects information for investigation of necessary alarms. As described above, the collecting unit 55 of the operation monitoring terminal 5 collects the investigation information of the alarm specified (for example, the alarm at the end of the countdown of the delay time) from among the alarms registered in the alarm management table 54a from the part of the control station 3 specified by the alarm.

After the process of step S4 is completed, the process of the flowchart ends.

Fig. 13 shows an example of registration processing by the registration unit 54. This processing is executed when the receiving unit 51 receives an alarm and the selecting unit 53 selects an alarm. Hereinafter, the alarm received by the receiving unit 51 and selected by the selecting unit 53 is referred to as "present alarm".

In step S11, the same arbitration and the like are retrieved. The registration unit 54 refers to the alarm management table 54a and searches for an arbitrated alarm that is the same as or related to the arbitration of the current alarm.

In step S12, it is determined whether or not there is the same record or the like. When an alarm of arbitration identical to or related to the arbitration of the current alarm exists in the alarm management table 54a, the registration unit 54 determines that the same record or the like exists. In the case of having the same record or the like (step S12: yes), the process proceeds to step S14. In a case where this is not the case (step S12: NO), the process proceeds to step S13.

In step S13, a new record is registered. The registration unit 54 additionally registers the current alarm in the alarm management table 54 a.

In step S14, it is determined whether or not suppression is ON. The registration unit 54 determines whether or not suppression of an arbitration alarm identical to or related to the arbitration of the current alarm is ON. As described above, in the case where the suppression is ON, the chronograph time is the dead time. In the case where this is not the case, the count time is a delay time. If the suppression is ON (yes in step S14), the process proceeds to step S16. In a case where this is not the case (step S14: NO), the process proceeds to step S15.

In step S15, the existing record is registered in an overwriting manner. The registration unit 54 registers the present alarm together with the delay time in the alarm management table 54a instead of the alarm registered in the alarm management table 54 a. The alarm management table 54a deletes (excludes) the alarm registered before, and the delay time is reset.

In step S16, registration is suspended. The registration unit 54 does not register (exclude) the present alarm.

After the process of step S13, step S15, or step S16 is completed, the process of the flowchart ends.

Fig. 14 shows an example of the alarm reading process registered in the alarm management table 54 a. This process is repeatedly executed as appropriate.

In step S21, the delay/dead band column value is counted down. That is, the counted time (delay time, dead time) of the alarm registered in the alarm management table 54a is counted down. This process is executed by the storage unit 52, the registration unit 54, or the collection unit 55, for example.

In step S22, it is determined whether or not the column value is 0 or less. It is determined whether or not the counted time after the countdown in step S21 before the execution becomes 0. This process is executed by the storage unit 52, the registration unit 54, or the collection unit 55, for example. If the column value is 0 or less (step S22: yes), the process proceeds to step S23. In a case where this is not the case (step S22: NO), the process proceeds to step S24.

In step S23, the record is taken out or deleted. The collection unit 55 takes out the alarm at the end of the countdown of the delay time from the alarm management table 54a, and collects information for investigation of the alarm. The collecting unit 55 deletes (excludes) the alarm at the end of the countdown of the dead time from the registering unit 54, and does not collect the survey information of the alarm. The deletion process may be executed by the storage section 52 or the registration section 54.

In step S24, it is determined whether or not there is an alarm registration record. It is determined whether or not there is an alarm registered in the alarm management table 54 a. This process is executed by the storage unit 52, the registration unit 54, or the collection unit 55, for example. In the case where there is an alarm registration record (step S24: YES), the process returns to step S21. In a case where this is not the case (step S24: no), the processing of the flowchart ends.

For example, as described above, the survey information is automatically collected by operating the monitor terminal 5 in response to an alarm from the control station 3. Since it is not necessary to go to the site by an engineer to collect information for investigation as in the conventional case, information for investigation can be collected efficiently. Further, if the count-down of the count-up time (delay time, dead time) is utilized, at least a part of the alarms in a group of alarms that are identical or have a correlation with each other can be excluded. Accordingly, the efficiency of collecting information for investigation is further improved.

One embodiment of the present invention has been described above. The technique of the present invention is not limited to the above-described embodiments. Some modifications will be described.

In the above embodiment, the alarm generated due to a failure of a part of the control station 3, an offline operation, or the like is described as an example of the alarm. However, the present invention is not limited to these examples, and alarms generated due to various events may be handled. Examples of the other alarms include an Alarm (a & E (Alarm and Event) in a PLC (Programmable Logic Controller) for PA (also referred to as Process Automation) and the like. Since the discrimination by arbitration described above with reference to fig. 3 can be applied to the PLC alarm, the alarm received from the relevant location can be a target for collecting information for investigation by the operation monitoring terminal 5.

In the above embodiment, an example in which the alarm is associated with the timer time by the monitoring target alarm table 53a has been described. However, the correspondence of the counted time to the alarm may be performed in various manners. The timer time may be associated with an alarm by operating any functional block in the monitoring terminal 5 at any timing until the alarm is registered in the alarm management table 54 a.

In the above embodiment, the example in which the collecting unit 55 collects the survey information of the alarm selected by the selecting unit 53 and registered by the registering unit 54 among the alarms received by the receiving unit 51 has been described. However, the selection by the selection section 53 and/or the registration by the registration section 54 are not essential. For example, the operation monitoring terminal 5 may not include the selection unit 53. In this case, the collecting unit 55 collects the information for investigation of the alarm received by the receiving unit 51 and registered by the registering unit 54. The operation monitoring terminal 5 may not include the registration unit 54. In this case, the collecting unit 55 collects information for investigation of the alarm received by the receiving unit 51 and selected by the selecting unit 53. The operation monitoring terminal 5 may not include the selection unit 53 and the registration unit 54. In this case, the collecting unit 55 collects information for investigation of the alarm received by the receiving unit 51.

In the above-described embodiment, an example in which at least a part of a set of alarms that are the same or have a correlation with each other is excluded using the count time (delay time and dead time) is explained. However, the method of alarm exclusion is not limited thereto. Such a modification will be described with reference to fig. 15 and 16.

Fig. 15 is a diagram showing an example of a schematic configuration of an operation monitoring terminal according to a modification. The illustrated operation monitoring terminal 5A is different from the operation monitoring terminal 5 (fig. 2) in that the selection unit 53 and the registration unit 54 are not included; storage unit 52A and collection unit 55A are included instead of storage unit 52 and collection unit 55; and a learning section 56.

The storage unit 52A is different from the storage unit 52 (fig. 2) in that it does not include the monitoring target alarm table 53a and the alarm management table 54 a; program 52aA is included instead of program 52 a; and includes a learning completion model 55b and training data 56 a. The program 52aA is a program for causing a computer to execute processing for operating the monitoring terminal 5A.

For example, if data (input data) corresponding to an alarm received by the receiving unit 51 is input, the learning completion model 55b outputs data (output data) for specifying an alarm to be a target for collecting information for investigation by the collecting unit 55. The "data corresponding to an alarm" may be, for example, data obtained by converting an alarm ID, information content, or the like into a data format suitable for input to the learning completion model 55 b. The "data for determining alarms" may be, for example, data representing probability values for the respective alarms. The alarm with the highest probability can be determined as the alarm to be the target of collecting the investigation information by the collection unit 55. The learning completion model 55b is also explained with reference to fig. 16.

Fig. 16 is a diagram showing an example of a schematic configuration of a learning completion model. In this example, the learning completion model 55b is a neural network including an input layer, a plurality of intermediate layers, and an output layer. Input data is input to the input layer. The output layer is, for example, a fully connected layer, and outputs the output data. The intermediate layer is disposed between the input layer and the output layer. Some of the neurons within each layer are schematically represented by white circles. An example of a neural Network is DQN (Deep Q-Network Deep reinforcement learning). The principle of the learning completion model having such a configuration is well known, and therefore, will not be described in detail.

If data corresponding to the same set of alarms previously described is input, the learning completion model 55b may output data that determines only one alarm in the set of alarms. The input data may be time series data of alarms received over a period of time. The learning completion model 55b may be learned including setting for a certain period. The certain period corresponds to the delay time as described above. That is, the same function as the alarm elimination function based on the delay time is realized by the learning completion model 55 b.

If data corresponding to a group of alarms having correlation with each other as described earlier is input, the learning completion model 55b may output data for which no determination is made for any one of the group of alarms. The input data may be time series data of alarms received over a period of time. The learning completion model 55b may be learned including setting of a certain period. This certain period corresponds to the dead time as described above. That is, the same function as the dead time-based alarm elimination function is realized by the learning completion model 55 b.

The learning completion model 55b is generated by training (mechanical learning or the like) using the training data 56a so that output data is output when input data is input. An example of training data is a data set that combines input data and output data. Such a data set may be prepared and stored in the storage unit 52A by the user using a past alarm received in the operation monitoring terminal 5, for example.

Returning to fig. 15, the collecting unit 55A collects information for investigation of an alarm specified by using the plurality of alarms received by the receiving unit 51 and the learning completion model 55 b. Specifically, the collecting unit 55A inputs data (which may be time-series data as described above) corresponding to the plurality of alarms received by the receiving unit 51 to the learning completion model 55 b. The learning completion model 55b outputs data for specifying an alarm to be a collection target of the investigation information among the plurality of alarms. The collection unit 55A refers to the abnormality correspondence step table 55A as described above, for example, and collects information for investigation of an alarm specified by the learning completion model 55 b.

According to the operation monitoring terminal 5A described above, the function of alarm elimination based on the timer time (delay time and dead time) is realized by the learning completion model 55 b. Therefore, for example, the selection unit 53, the monitored object alarm table 53a, the registration unit 54, the alarm management table 54a, and the like of the monitoring terminal 5 do not need to be operated. The configuration of the operation monitoring terminal 5A can be simplified accordingly, and the design cost and the like for setting the timer time can be reduced.

The learning unit 56 performs learning of the learning completion model 55b using the training data 56a stored in the storage unit 52A. Thus, the learning completion model 55b can be generated, and the learning completion model 55b can be updated by learning using the latest training data 56a each time the latest training data 56a based on the latest reception alarm or the like is prepared and stored in the storage unit 52A. The learning unit 56 and the training data 56a may be provided outside the operation monitoring terminal 5A (for example, an information processing device not shown). In this case, the training-completed learning model 55b (e.g., adjusted DQN) generated outside the operation monitoring terminal 5A is supplied to the operation monitoring terminal 5A to be used.

Fig. 17 is a diagram showing an example of a hardware configuration of the operation monitoring terminal. The computer or the like including the illustrated hardware configuration functions as the operation monitoring terminal 5 described above. An exemplary hardware configuration includes a communication device 5a, a display device 5b, an HDD (Hard Disk Drive) 5c, a memory 5d, and a processor 5e, which are connected to each other via a bus or the like.

The communication device 5a is a network interface card or the like, and can communicate with other devices. The display device 5b is, for example, a touch panel, a display, or the like. The HDD5c functions as the storage unit 52, and stores programs 52a (operation monitoring program, information collection program), for example.

The processor 5e reads the program 52a from the HDD5c or the like and develops the program in the memory 5d, thereby causing the computer to function as the operation monitoring terminal 5. The functions include the function of the selection section 53, the function of the registration section 54, and the function of the collection section 55 as described above.

The program 52a can be distributed via a network such as the internet. The program 52a can be recorded on a computer-readable recording medium such as a hard disk, a Flexible Disk (FD), a CD-ROM, an MO (magnetic-Optical disk), a DVD (Digital Versatile disk), or the like, and can be read from the recording medium by a computer and executed.

The devices other than the operation monitoring terminal 5, for example, the engineering terminal 4, may include the same hardware configuration as described above.

The operation monitoring terminal 5 (an example of the information processing apparatus) described above is determined as follows, for example. As described with reference to fig. 1, 2, and the like, the operation monitoring terminal 5 includes: a receiving unit 51 that receives an alarm indicating an abnormality in the control station 3 for the plant 1; and a collecting unit 55 for collecting information for investigation of the cause of the alarm from the part of the control station 3 specified based on the alarm received by the receiving unit 51.

According to the operation monitoring terminal 5, the survey information is automatically collected based on the alarm from the control station 3. Therefore, the information for investigation can be collected efficiently.

As described with reference to fig. 2, 6, and the like, the collection unit 55 can collect the survey information by referring to the abnormality correspondence step table 55a in which the alarm is associated with the collection step of the survey information. For example, the information for investigation can be collected by an appropriate collection procedure.

The collection of the information for investigation of the alarm received by the receiving unit 51 by the collecting unit 55 may be started after a certain period of time has elapsed from the time of reception of the alarm. This makes it possible to avoid information collection when there is a possibility that an unstable operation of the site of the control station 3 may occur (for example, during oscillation) immediately after an alarm is generated, for example, and to collect information for investigation at an appropriate timing when the operation of the site is stable.

As described with reference to fig. 3 and the like, the alarm can be identified in correspondence with arbitration that combines the part information indicating the kind of the part of the control station 3 and the position information indicating the position of the part. The part information may include at least one of information indicating a control bus to which the control station 3 is connected, information indicating a CPU card in the control station 3, information indicating the whole of an I/O suite in the control station 3, and information indicating an I/O module in the control station 3. The position information may include at least one of information indicating a position of a domain of a control bus that divides the plurality of control stations 3 for each domain (domain D1, etc.), information indicating a position of a control station 3 within a domain (domain D1, etc.), information indicating a position of an operating CPU or a standby CPU among redundant CPUs (CPU cards) within the control station 3, information indicating a position of an I/O system within the control station 3, information indicating a position of an I/O suite within the control station 3, information indicating a position of an I/O device unit within the I/O suite, and information indicating a position of a slot within the I/O device unit. The collecting unit 55 may collect the survey information from the part of the control station 3 determined by the arbitration based on the alarm received by the receiving unit 51. For example, by identifying an alarm by arbitration in the manner described above, information for investigation of an appropriately determined alarm can be collected.

As described with reference to fig. 2 and 5, the operation monitoring terminal 5 may include the registration unit 54 that registers the alarm received by the reception unit 51, arbitration, and the counted time in the alarm management table 54a in association with each other, and the collection unit 55 may not collect the survey information for the alarm that is registered in the alarm management table 54a and whose counted time is counted down. For example, the survey information can be collected at the appropriate timing.

As described with reference to fig. 4, 5, 7 to 9, and the like, the counted time may be a delay time for delaying the collection of the survey information of the corresponding alarm, the registration unit 54 may register the same alarm as the alarm registered in the alarm management table 54a and having the delay time in countdown in the alarm management table 54a as an override, the override registration may include resetting the delay time in countdown, and the collection unit 55 may collect the survey information of the alarm in which the countdown of the delay time is completed. The same alarm may be identified corresponding to the same arbitration, and the registration unit 54 registers the same arbitration of the alarm registered in the alarm management table 54a and whose delay time is counted down in the alarm management table 54a as the arbitration. For example, by using such a delay time, it is possible to exclude a part of alarms in the same set of alarms, and accordingly, to further improve the efficiency of collecting information for investigation.

As described with reference to fig. 4, 5, 10, 11, and the like, the counted time may be a dead time for ignoring alarms having a correlation with each other, the registering unit 54 may not register alarms having a correlation with alarms registered in the alarm management table 54a and having a dead time in countdown in the alarm management table 54a, and the collecting unit 55 may not collect information for investigation of alarms having ended the countdown of the dead time. Alarms having a correlation may be identified in association with the correlated arbitration, and the registration unit 54 may not register the arbitrated alarms associated with the arbitration of the alarms registered in the alarm management table 54a and having the dead time in the countdown to the alarm management table 54 a. For example, by using such a dead time, a group of alarms having a correlation with each other can be excluded, and accordingly, the efficiency of collecting information for investigation can be further improved.

As described with reference to fig. 2 and the like, the operation monitoring terminal 5 may include the selection unit 53 that selects an alarm to be monitored from among the alarms received by the reception unit 51, and the registration unit 54 may register the alarm selected by the selection unit 53 in the alarm management table 54 a. This enables, for example, a warning to be selected (filtered) in advance to cancel the need for collecting the survey information.

As described with reference to fig. 15, 16, and the like, the collecting unit 55A may collect the survey information of the alarm specified by using the plurality of alarms received by the receiving unit 51 and the learning completion model 55b, and when data corresponding to the plurality of alarms is input, the learning completion model 55b may output data specifying the alarm to be collected as the survey information. By using such a learning completion model 55b, for example, a function of alarm elimination based on a timer time (delay time and dead time) can also be realized.

The program 52a described with reference to fig. 2 and 17 and the like is also an embodiment of the present invention. The computer executes the program 52a to perform the following processing: an alarm indicating an abnormality in the control station 3 for the plant 1 is received, and information for investigation of the cause of the alarm is collected from a site of the control station 3 specified based on the received alarm. The program 52a can also effectively collect the information for investigation as described above. As described with reference to fig. 17 and the like, a recording medium on which the program 52a is recorded is also an embodiment of the present invention.

The information collection method described with reference to fig. 12 and the like is also an embodiment of the present invention. The information collection method comprises the following steps: the operation monitoring terminal 5 (an example of an information collecting device) receives an alarm indicating an abnormality in the control station 3 for the plant 1 (step S1); the operation monitoring terminal 5 collects information for investigation of the cause of the alarm from the site of the control station 3 specified based on the received alarm (step S4). By this information collection method, the survey information can be collected efficiently as described above.

Claims

1. An information collection apparatus characterized by comprising:

a receiving unit that receives an alarm indicating an abnormality in a control station for a plant; and

and a collecting unit that collects information for investigation of the cause of the alarm from a location of the control station specified based on the alarm received by the receiving unit.

2. The information collection device according to claim 1, wherein the collection unit collects the survey information by referring to an abnormality correspondence step table that associates an alarm with a collection step of the survey information.

3. The information collection device according to claim 1 or 2, wherein the collection unit starts collecting the survey information of the alarm received by the reception unit after a certain period of time has elapsed from the time of reception of the alarm.

4. The information collecting apparatus according to claim 1 or 2,

the alarm is identified in correspondence with an arbitration that combines part information indicating the type of part of the control station and position information indicating the position of the part,

the location information includes

Information indicating a control bus to which a control station is connected,

Information indicating a CPU card in the control station,

Information indicating the entirety of an I/O suite in a control station, and

information indicating I/O module in control station

At least one of the above-mentioned (b),

the location information includes

Information indicating the location of a domain of a control bus that divides a plurality of control stations into each domain,

Information indicating the location of a control station within a domain,

Information indicating the position of the running CPU or the standby CPU among the redundant CPUs in the control station,

Information indicating the location of the I/O system within the control station,

Information indicating the location of the I/O suite within the control station,

Information indicating the location of an I/O device unit within an I/O suite, and

information indicating the location of a slot within an I/O device unit

At least one of the above-mentioned (b),

the collecting unit collects the survey information from a site of the control station determined by arbitration based on the alarm received by the receiving unit.

5. The information collecting apparatus according to claim 4,

includes a registration section for registering the alarm, arbitration and timer time received by the reception section in an alarm management table in correspondence,

the collecting unit does not collect the survey information registered in the alarm management table and having a counted time as an alarm during countdown.

6. The information collecting apparatus according to claim 5,

the timer time is a delay time for delaying collection of the survey information of the corresponding alarm,

the registration unit registers in the alarm management table the same alarm as the alarm registered in the alarm management table and whose delay time is counted down,

the overlay registration includes resetting the delay time in the countdown,

the collecting unit collects the survey information of an alarm indicating an end of countdown of the delay time.

7. The information collecting apparatus according to claim 6,

the same alarms are identified corresponding to the same arbitration,

the registration unit registers an alarm override in the alarm management table, the arbitration being the same as the arbitration of the alarm registered in the alarm management table and having a delay time of countdown.

8. The information collecting apparatus according to claim 5,

the timer time is a dead time for ignoring alarms having a correlation with each other,

the registration unit does not register an alarm, which is associated with an alarm registered in the alarm management table and whose dead time is counted down, in the alarm management table,

the collecting unit does not collect the survey information of the alarm when the countdown of the dead time is completed.

9. The information collecting apparatus according to claim 8,

the correlated alarms are identified in correspondence with the correlated arbitration,

the registration unit does not register an arbitrated alarm in the alarm management table, the arbitrated alarm being associated with arbitration of alarms registered in the alarm management table and having a dead time in countdown.

10. The information collecting apparatus according to any one of claims 5 to 9,

includes a selection unit for selecting an alarm to be monitored from the alarms received by the reception unit,

the registration unit registers the alarm selected by the selection unit in the alarm management table.

11. The information collecting apparatus according to claim 1 or 2,

the collecting unit collects the survey information using the plurality of alarms received by the receiving unit and the alarm specified by the learning completion model,

when data corresponding to a plurality of alarms is input, the learning completion model outputs data for specifying an alarm to be a collection target of the survey information.

12. A computer-readable recording medium having an information collection program recorded thereon, characterized in that,

the computer executes the information collection program to execute the following processing:

receiving an alert indicative of an anomaly associated with a control station for a plant; and

information for investigation of the cause of the alarm is collected from a site of the control station specified based on the received alarm.

13. An information collection method, characterized by comprising:

an information collection device receives an alarm indicating an abnormality related to a control station for a plant; and

the information collection device collects information for investigation of the cause of the alarm from a site of the control station specified based on the received alarm.